Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-09-2024 13:24
Static task
static1
Behavioral task
behavioral1
Sample
3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe
Resource
win10v2004-20240802-en
General
-
Target
3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe
-
Size
1.4MB
-
MD5
7c89b48a2752a771eb6457fe2fea1d8e
-
SHA1
afb602ef798b23f400fd3d474cb570aa781797c4
-
SHA256
3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce
-
SHA512
9338a3817216563677573599d5dd3cacb4be084a2e46c77516d56a207ce7d8d06a376ea4be1a7863ffeb823ae803b891ef947cfb81d4813a52ce152038e97d48
-
SSDEEP
24576:OnpUwegOzvr+8J97vsJRx1osJYWDaK9rB6hjscMmQV5IPiMtWb05UaaYy6nnjqKh:OCri8H7vsjx1V15B6xscMmY6ivQUNEjF
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
webmaster - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1928 powershell.exe 2652 powershell.exe 2768 powershell.exe 1840 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1404 set thread context of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2572 set thread context of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1996 schtasks.exe 1616 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1928 powershell.exe 2652 powershell.exe 2768 powershell.exe 1840 powershell.exe 2928 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 2928 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1928 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 2768 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeDebugPrivilege 2928 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1404 wrote to memory of 1928 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 31 PID 1404 wrote to memory of 1928 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 31 PID 1404 wrote to memory of 1928 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 31 PID 1404 wrote to memory of 1928 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 31 PID 1404 wrote to memory of 2652 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 33 PID 1404 wrote to memory of 2652 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 33 PID 1404 wrote to memory of 2652 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 33 PID 1404 wrote to memory of 2652 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 33 PID 1404 wrote to memory of 1996 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 34 PID 1404 wrote to memory of 1996 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 34 PID 1404 wrote to memory of 1996 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 34 PID 1404 wrote to memory of 1996 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 34 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 1404 wrote to memory of 2572 1404 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2572 wrote to memory of 2768 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 38 PID 2572 wrote to memory of 2768 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 38 PID 2572 wrote to memory of 2768 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 38 PID 2572 wrote to memory of 2768 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 38 PID 2572 wrote to memory of 1840 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 40 PID 2572 wrote to memory of 1840 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 40 PID 2572 wrote to memory of 1840 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 40 PID 2572 wrote to memory of 1840 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 40 PID 2572 wrote to memory of 1616 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 42 PID 2572 wrote to memory of 1616 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 42 PID 2572 wrote to memory of 1616 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 42 PID 2572 wrote to memory of 1616 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 42 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2572 wrote to memory of 2928 2572 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IbwIIBmUDWimTZ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IbwIIBmUDWimTZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD88.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1996
-
-
C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wlBldyvi.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3F22.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5676f2d9a467c059d42131ec0a8534880
SHA18535f16acd7886f632f06a06257db2941b4b9b3b
SHA256af9c912c5236b2a52c49acc22f60c71afe5c31654337acd8473507f6e6249bf3
SHA512c42be154532b07f8f1d08b722052f01d41c72bc6fe07b3ede3916ba7d7fb35ff9a2c80f3ee67295737266be42cc8998a0696c77444e4770db291f2ad8addf5de
-
Filesize
1KB
MD525ddd915e1ff01385dcaf215cb8b0982
SHA179a9410488e4f3ec275397dcb7f03cef6c2cb98c
SHA2569d823e41f90a552f787fb7c69fa15eb763dd6fa4c510089f53f23961a9ab14ff
SHA5125835a1e6c364232a81270322635dfab1b4c9c224d59b017c8cdf5adfb86caa9101f7ebf7cf9954fb0853342a744c500a37334c0a0464a34937e5f1c13ede9ac5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8JPB9Q0GXPPLVY3N7LRT.temp
Filesize7KB
MD5e3844c0412df2dc9a3cf9d4318a9f08b
SHA16f85b7ee2bac23c59d92ea88c5ad917b56ec1e96
SHA25680c4f0b82c460f20e7da16f4aeae6ba88d9d3456ebb7f4beb05b1214eda11eb0
SHA512a0c92b234d2304cda349402e25bd7b2155df6c26faf3c72b3e3ef2bb513c5f283e9666dc1bfe433a5497ce9b5eab7c9d750a419eaaa8055447912e9a4686532d
-
Filesize
1.4MB
MD57c89b48a2752a771eb6457fe2fea1d8e
SHA1afb602ef798b23f400fd3d474cb570aa781797c4
SHA2563d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce
SHA5129338a3817216563677573599d5dd3cacb4be084a2e46c77516d56a207ce7d8d06a376ea4be1a7863ffeb823ae803b891ef947cfb81d4813a52ce152038e97d48